Feat/apple motion design - #2
Merged
Merged
Conversation
Extends the existing src/lib/config.ts (rather than adding a parallel config module) with Stellar network/contract IDs, analytics/Sentry IDs, KYC/messaging feature flags, and app metadata, plus documents them in .env.example.
Adds src/app/error.tsx (route-segment errors, on-brand fallback with a "Try again" reset action) and src/app/global-error.tsx (root layout failures, self-contained since it can't rely on the layout's providers or styles). Previously an unhandled render error had no recovery UI.
…base AuthError and MockServiceError were two independent one-line Error subclasses with no shared type. Introduces src/lib/errors.ts with an AppError base both now extend, plus logError() as the single call site for reporting unexpected errors (wired to the SENTRY_DSN config added in the previous batch — logs to console until the Sentry SDK is installed). useAppStore's run() now calls logError() before rethrowing errors that aren't recognized business-rule failures, so they're captured before hitting the new error.tsx boundary.
…, etc.) next.config.mjs now sets Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Strict-Transport- Security on every response. Tried a nonce/strict-dynamic CSP in middleware first, but the App Router streams RSC hydration data via unnonced inline <script> tags on statically prerendered routes (most of this app), which a strict-dynamic policy would silently block in real browsers — verified via `next build && next start` + curl. Went with a static CSP via next.config.mjs headers() instead: same coverage, no per-request middleware cost, and it doesn't require giving up static generation.
The token cookie had no Secure attribute, so it'd be sendable over plain HTTP if the app were ever reachable that way. Sets Secure whenever the page itself is loaded over HTTPS (unconditional Secure would break the plain-HTTP local dev server). Left a comment on why it can't be HttpOnly: it's set from client JS since there's no backend yet to issue it as a server-set cookie.
…itization Adds src/lib/validation.ts (isValidEmail, isValidUsdcAmount, sanitizeText) and dedupes the email regex that was previously copy-pasted into both auth.service.ts and wizardValidation.ts. Also closes real gaps at the mock backend's boundary (the layer that should never trust the client, mirroring what a real API would do): deposit() had no upper bound on amount, and sendMessage/submitMilestone/ requestChanges/createProject accepted raw text with no trimming, control- character stripping, or empty-after-trim check server-side (the UI already guards most of these, but a caller bypassing it previously wasn't stopped). Skipped the useForm hook and CSRF token plumbing from the reference spec: useForm has no real call site here (existing forms already use per-field validators like wizardValidation.ts) and would just be unused code, and a client-generated CSRF token with no backend to validate it against isn't real protection — there's still no src/app/api in this repo.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.